# Is there a way to prevent Duplicate alerts from appearing in EVE logs within a period of time?

**URL:** <https://forum.suricata.io/t/is-there-a-way-to-prevent-duplicate-alerts-from-appearing-in-eve-logs-within-a-period-of-time/3762>\
**Category:** Rules\
**Tags:** rules, suricata\
**Created:** [July 31, 2023, 1:55pm UTC](https://forum.suricata.io/t/is-there-a-way-to-prevent-duplicate-alerts-from-appearing-in-eve-logs-within-a-period-of-time/3762 "2023-07-31T13:55:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rob\_catapano](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/rob_catapano/32/1556_2.png) [@rob\_catapano](https://forum.suricata.io/u/rob_catapano)\
**Post date:** [July 31, 2023, 1:55pm UTC](https://forum.suricata.io/t/is-there-a-way-to-prevent-duplicate-alerts-from-appearing-in-eve-logs-within-a-period-of-time/3762/1 "2023-07-31T13:55:19Z")

</div>

I noticed the EVE log files can contain allot of alerts there are very similar - albeit maybe different flowids. Is there a way to configure Suricata to not show so many alerts that are basically duplications (within some time period)?

Thank you

---

<div class="post-metadata">

**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\
**Post date:** [July 31, 2023, 5:16pm UTC](https://forum.suricata.io/t/is-there-a-way-to-prevent-duplicate-alerts-from-appearing-in-eve-logs-within-a-period-of-time/3762/2 "2023-07-31T17:16:04Z")

</div>

Hi Rob,

perhaps you wish to explore the “Threshold” feature in Suricata. With that, you can e.g. limit how many alerts can be generated in the given time frame.

See:  
[Global thresholds](https://docs.suricata.io/en/latest/configuration/global-thresholds.html)  
[Per-rule thresholds](https://docs.suricata.io/en/latest/rules/thresholding.html)

Lukas